FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

ceph14 -- HTTP header injection via CORS ExposeHeader tag

Affected packages
ceph14 < 14.2.11

Details

VuXML ID f20eb9a4-dfea-11ea-a9b8-9c5c8e84d621
Discovery 2020-05-27
Entry 2020-08-16

Red Hat bugzilla reports:

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made.

References

CVE Name CVE-2020-10753
FreeBSD PR ports/248673
URL https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753